CWE-1279: Cryptographic Operations are run Before Supporting Units are Ready
ID
CWE-1279
Abstraction
Base
Structure
Simple
Status
Incomplete
Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.
Many cryptographic hardware units depend upon other hardware units to supply information to them to produce a securely encrypted result. For example, a cryptographic unit that depends on an external random-number-generator (RNG) unit for entropy must wait until the RNG unit is producing random numbers. If a cryptographic unit retrieves a private encryption key from a fuse unit, the fuse unit must be up and running before a key may be supplied.
Modes of Introduction
| Phase | Note |
|---|---|
| Architecture and Design | |
| Implementation | The decision to continue using a cryptographic unit even though the input units to it are not producing valid data will compromise the encrypted result. |
Applicable Platforms
| Type | Class | Name | Prevalence |
|---|---|---|---|
| Language | Verilog | ||
| Language | VHDL | ||
| Language | Not Language-Specific | ||
| Operating_system | Not OS-Specific | ||
| Architecture | Not Architecture-Specific | ||
| Technology | Processor Hardware | ||
| Technology | Not Technology-Specific |
Common Attack Pattern Enumeration and Classification (CAPEC)
The Common Attack Pattern Enumeration and Classification (CAPEC™) effort provides a publicly available catalog of common attack patterns that helps users understand how adversaries exploit weaknesses in applications and other cyber-enabled capabilities.
CAPEC at Mitre.org
Loading...